Target credit hack relied on failings of magnetic strip
A customer signs a credit card statement next to a scanner in a Target store on December 19, 2013 in Miami, Florida. Target announced that about 40 million credit and debit card accounts of customers who made purchases by swiping their cards at terminals in its U.S. stores between November 27 and December 15 may have been stolen.
One of the reasons it was so easy for thieves to steal all those credit card numbers from Target recently is right on the back of the cards we carry. The magnetic strip technology we’re currently using was invented at the same time as the tape recorder -- over forty years ago (can you even think back that far?). In tech years makes that makes magnetic strips practically prehistoric, and, vulnerable. Fraud costs merchants and banks billions a year.
“I think eighty countries use the chip and pin, or EMV technologies,” says Chris Wysopal, co-founder, and CTO of Veracode, which provides security for companies that process credit card transactions. “It’s really cut their fraud in half,” he says. Every time a card with a chip is used, it generates a unique number, a strategy which in theory, says Wysopal, should prevent the type of theft that occurred at Target.
But while people from the EU to Kenya use cards embedded with chips, retailers and credit card processors in the United States are stuck arguing about the best option for using the new technology: chips and pin numbers or chips and signatures.
“We don’t want to spend a fortune to do a half good solution,” says Mallory Duncan, Senior Vice President, General Counsel, for the National Retail Federation. “The legacy systems were based on a magnetic stripe and a signature. If we’re going to move forward we really need a chip and a pin.”
Duncan says retailers want chips and pin numbers which he says is the safer choice. But he says the financial services industry is holding out for the solution that will make it more money – chips and signatures.
“The idea that there’s some economic incentive for card networks to delay the move from magnetic stripe card to EMV, simply doesn’t make any sense,” says Jason Oxman, CEO of the Electronic Transactions Association. Oxman notes that consumers have grown comfortable with the cards bearing magnetic strips and may be reluctant to change. And the change itself, says Oxman, which would require the vast retail landscape across the country to coordinate an upgrade, will take time and money.
“Merchants have to install new equipment at their premises, and merchants have been hesitant to do so, quite frankly, because they want to wait and see if consumers have cards with chips in them before they make those upgrades,” he says.
There is a plan in place, says Oxman, for updating our credit cards. He says you can expect to see new cards in the fall of 2015, although the specifics aren’t yet clear.
In the meantime consumers will continue to sign and swipe and try to avoid skimmers and scams.
Chris Wysopal remains skeptical about the reasons given for the process which seems to be dragging on and on. After all, losses like the recent theft at Target cost both the retail and financial services industry alike.
“Think about the cost of an upgrade,” he says, “someone must have done a calculation saying it’s gotta be more expensive than that to upgrade, or it would be a no-brainer.”